Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2024-1249 |
high | 7.4 | 0.0045 | 2024-04-17 | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cr | |
CVE-2026-102675 |
high | 7.4 | 0.0021 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C | |
CVE-2026-57989 |
high | 7.4 | 0.0043 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo | |
CVE-2026-89058 |
high | 7.4 | 0.0026 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflec | |
CVE-2026-115413 |
high | 7.3 | 0.0010 | 2026-10-27 | Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before vers | |
CVE-2026-43870 |
high | 7.3 | 0.0038 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa | |
CVE-2026-19418 |
high | 7.3 | 0.0024 | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective | |
CVE-2026-54605 |
high | 7.2 | 0.0019 | 2026-07-28 | OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0. | |
CVE-2026-66322 |
high | 7.1 | 0.0023 | 2026-08-03 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor | |
CVE-2026-41057 |
high | 7.1 | 0.0013 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation | |
CVE-2026-46555 |
high | 7.1 | 0.0021 | 2026-07-20 | WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a | |
CVE-2026-63118 |
medium | 6.9 | 0.0024 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23. | |
CVE-2026-116254 |
medium | 6.9 | 0.0026 | 2026-10-26 | A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. Thi | |
CVE-2026-66313 |
medium | 6.8 | 0.0023 | 2026-08-03 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor | |
CVE-2026-96238 |
medium | 6.5 | 0.0030 | 2026-10-13 | Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a | |
CVE-2026-69877 |
medium | 6.5 | 0.0046 | 2026-10-13 | Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over | |
CVE-2023-23601 |
medium | 6.5 | 0.0035 | 2023-06-02 | Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab whic | |
CVE-2023-28164 |
medium | 6.5 | 0.0035 | 2023-06-02 | Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user co | |
CVE-2026-5283 |
medium | 6.5 | 0.0027 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote atta | |
CVE-2026-12024 |
medium | 6.5 | 0.0016 | 2026-06-11 | Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remot | |
CVE-2026-13022 |
medium | 6.5 | 0.0020 | 2026-06-24 | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote a | |
CVE-2026-13793 |
medium | 6.5 | 0.0025 | 2026-06-30 | Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote atta | |
CVE-2026-13822 |
medium | 6.5 | 0.0018 | 2026-06-30 | Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowe | |
CVE-2026-13826 |
medium | 6.5 | 0.0025 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed | |
CVE-2026-13838 |
medium | 6.5 | 0.0024 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-13839 |
medium | 6.5 | 0.0024 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-13840 |
medium | 6.5 | 0.0025 | 2026-06-30 | Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
CVE-2026-13868 |
medium | 6.5 | 0.0024 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a | |
CVE-2026-13881 |
medium | 6.5 | 0.0021 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a rem | |
CVE-2026-13887 |
medium | 6.5 | 0.0025 | 2026-06-30 | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a rem | |
CVE-2026-13913 |
medium | 6.5 | 0.0025 | 2026-06-30 | Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a | |
CVE-2026-58266 |
medium | 6.5 | 0.0022 | 2026-07-07 | Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based page | |
CVE-2026-15768 |
medium | 6.5 | 0.0024 | 2026-07-14 | Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a | |
CVE-2026-15775 |
medium | 6.5 | 0.0024 | 2026-07-14 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacke | |
CVE-2026-48022 |
medium | 6.5 | 0.0018 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Au | |
CVE-2026-17743 |
medium | 6.5 | 0.0024 | 2026-07-30 | Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a | |
CVE-2026-17748 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote | |
CVE-2026-17754 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac | |
CVE-2026-17787 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17823 |
medium | 6.5 | 0.0024 | 2026-07-30 | Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17842 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowe | |
CVE-2026-17846 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a r | |
CVE-2026-17850 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote | |
CVE-2026-17852 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remot | |
CVE-2026-17854 |
medium | 6.5 | 0.0024 | 2026-07-30 | Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote a | |
CVE-2026-17883 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-54665 |
medium | 6.3 | 0.0033 | 2026-06-22 | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request hea | |
CVE-2026-47703 |
medium | 6.3 | 0.0014 | 2026-07-15 | AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Ho | |
CVE-2026-118657 |
medium | 5.9 | 0.0013 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forward | |
CVE-2026-109461 |
medium | 5.9 | 0.0036 | 2026-10-16 | Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorize |